Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Electrum binaries flagged by some antivirus (false positive) #3198

Closed
shervud opened this issue Nov 3, 2017 · 22 comments
Closed

Electrum binaries flagged by some antivirus (false positive) #3198

shervud opened this issue Nov 3, 2017 · 22 comments
Labels
antivirus-false-positive ❎ OS-windows 🪟

Comments

@shervud
Copy link

shervud commented Nov 3, 2017

The problem is described in Subject.
It detects electrum as Heur.AdvML.B virus.
Here is a screenshot
electrum

I download electrum from the next link : https://download.electrum.org/3.0/electrum-3.0.0.exe
Is it problem in antivirus or is there any risk to download from your site malware file. I mean, is there some possible risk that DNS was changed and so on. Like some one tries to compromise your website or downloadable file?
At my 2nd PC with Windows 10 all is fine, but there another antivirus exists.

Thank you.
@lzsaver
Copy link
Contributor

lzsaver commented Nov 3, 2017

Heur means a heuristic algorithm. So Symantec is not sure.
It's False Positive. You may report this to Symantec here: link.

@malafaya
Copy link

malafaya commented Nov 6, 2017

Windows Defender detects Trojan:Win32/Bitrep.A . This seems to happen only with the standalone wallet.

@SomberNight SomberNight mentioned this issue Nov 7, 2017
Closed
@lzsaver
Copy link
Contributor

lzsaver commented Nov 12, 2017

Submit Electrum to Microsoft, select "this file has been incorrectly detected".

@jonathancross
Copy link
Contributor

FYI: Not being flagged in VirusTotal.

@dark-yak
Copy link

After downloading electrum-3.0.3-portable.exe and also the portable version, my antivirus detects it as a trojan.

6 engines on virustotal also detect that...
https://www.virustotal.com/fr/file/ef5f4bcbb19901bebca743323ae7af48fc349837fcf6a09f9a861c18ff8dbe13/analysis/1513122127/

@fdiengdoh
Copy link

Me too I got a warning on Defender and it auto delete the file as it's flagged as severe.

@bauerj
Copy link
Collaborator

bauerj commented Jan 27, 2018

The latest version of Electrum seems to have no false positives: https://www.virustotal.com/#/url/74a504769e700af48b0885e48705917e36fb3c3ab9700e3ad0b17d042b38a307/detection

@bauerj bauerj closed this as completed Jan 27, 2018
@SomberNight
Copy link
Member

@bauerj the URL doesn't but the file does.
https://www.virustotal.com/#/file/4a9eff07ce679d3aa701780cc4dd5e4c228baf60c503689c9cac64e234efcc9a/detection
https://www.virustotal.com/#/file/da6c66f25e5a21c5bde1f193e80fddf06adc6c36f94c3ebc053ad680f3ba2bf6/detection

I think all these false positives started to appear after the 3.0 release, when we switched to python3 and pyinstaller3, right?
Maybe this is due to using pyinstaller3.
See e.g.
pyinstaller/pyinstaller#847
pyinstaller/pyinstaller#603
google/spatial-media#97

@SomberNight SomberNight reopened this Feb 8, 2018
@SomberNight SomberNight changed the title After downloading Electrum antivirus (Symantec) detects it as virus Electrum binaries flagged by some antivirus (false positive) Feb 8, 2018
@SomberNight
Copy link
Member

I was thinking we could try to encrypt the binaries, to throw off antivirus heuristics. We would need to do this in a way that doesn't negate all the work done toward deterministic builds...

Pyinstaller seems to have some support for this https://pythonhosted.org/PyInstaller/usage.html#encrypting-python-bytecode
(note: it does not mention how to specify an IV?? it will certainly not be deterministic if it randomly generates one)

But looks like there are some problems with using this pyinstaller-provided-encryption:
pyinstaller/pyinstaller#2365
pyinstaller/pyinstaller#3160

@bauerj
Copy link
Collaborator

bauerj commented Feb 8, 2018 •
edited
Loading

I'm not sure if that wouldn't make the binary look even more suspicious for virus scanners. Maybe we can reach out to antivirus providers so they can mark this as a false-positive?

@rasa
Copy link

rasa commented Mar 10, 2018 •
edited
Loading

For the Windows 3.10 release files:

6a5133fc1a7d2c1b32f0afb23d03ee701b03f8fc8463e9607e93c214ad9faa82 *electrum-3.1.0.exe
be47acf4113ad3a9cde7491ae6eeb63919f178b54aa4a370d180dd98ed31e1c6 *electrum-3.1.0-portable.exe
010a910f866e0fdd8bc85f96fb20d2919ff87642db6aee8be254520bf300d8a5 *electrum-3.1.0-setup.exe

VirusTotal is reporting the following:
electrum-3.1.0.exe: 9/65
electrum-3.1.0-portable.exe: 8/67
electrum-3.1.0-setup.exe: 4/65

Also, sigcheck -a reports the files are dated 2017-07-31, and are not (code) signed:

electrum-3.1.0-portable.exe:
        Verified:       Unsigned
        Link date:      7:20 AM 7/31/2017
        Publisher:      n/a
        Company:        n/a
        Description:    n/a
        Product:        n/a
        Prod version:   n/a
        File version:   n/a
        MachineType:    32-bit
        Binary Version: n/a
        Original Name:  n/a
        Internal Name:  n/a
        Copyright:      n/a
        Comments:       n/a
        Entropy:        7.997
electrum-3.1.0-setup.exe:
        Verified:       Unsigned
        Link date:      4:33 PM 7/31/2017
        Publisher:      n/a
        Company:        Electrum
        Description:    Electrum Installer
        Product:        Electrum Installer
        Prod version:   3.1.0
        File version:   3.1.0
        MachineType:    32-bit
        Binary Version: 1.0.0.0
        Original Name:  Electrum.exe
        Internal Name:  Electrum Installer
        Copyright:      2013-2016 Electrum Technologies GmbH
        Comments:       The installer for Electrum
        Entropy:        7.999
electrum-3.1.0.exe:
        Verified:       Unsigned
        Link date:      7:20 AM 7/31/2017
        Publisher:      n/a
        Company:        n/a
        Description:    n/a
        Product:        n/a
        Prod version:   n/a
        File version:   n/a
        MachineType:    32-bit
        Binary Version: n/a
        Original Name:  n/a
        Internal Name:  n/a
        Copyright:      n/a
        Comments:       n/a
        Entropy:        7.997

The only way I could trust these installers was to check their gpg signatures, which I doubt most new users will go to the trouble to do:

> gpg --keyserver hkps.pool.sks-keyservers.net --recv-key 0x2bd5824b7f9470e6
> gpg --verify electrum-3.1.0.exe.asc electrum-3.1.0.exe
gpg: Signature made 03/05/18 07:50:03
gpg:                using RSA key 2BD5824B7F9470E6
gpg: Good signature from "Thomas Voegtlin (https://electrum.org) <thomasv@electrum.org>" [unknown]
gpg:                 aka "ThomasV <thomasv1@gmx.de>" [unknown]
gpg:                 aka "Thomas Voegtlin <thomasv1@gmx.de>" [unknown]
gpg: WARNING: This key is not certified with a trusted signature!
gpg:          There is no indication that the signature belongs to the owner.
Primary key fingerprint: 6694 D8DE 7BE8 EE56 31BE  D950 2BD5 824B 7F94 70E6
> gpg --verify electrum-3.1.0-portable.exe.asc electrum-3.1.0-portable.exe
gpg: Signature made 03/05/18 07:49:53
gpg:                using RSA key 2BD5824B7F9470E6
gpg: Good signature from "Thomas Voegtlin (https://electrum.org) <thomasv@electrum.org>" [unknown]
gpg:                 aka "ThomasV <thomasv1@gmx.de>" [unknown]
gpg:                 aka "Thomas Voegtlin <thomasv1@gmx.de>" [unknown]
gpg: WARNING: This key is not certified with a trusted signature!
gpg:          There is no indication that the signature belongs to the owner.
Primary key fingerprint: 6694 D8DE 7BE8 EE56 31BE  D950 2BD5 824B 7F94 70E6
> gpg --verify electrum-3.1.0-setup.exe.asc electrum-3.1.0-setup.exe
gpg: Signature made 03/05/18 07:50:03
gpg:                using RSA key 2BD5824B7F9470E6
gpg: Good signature from "Thomas Voegtlin (https://electrum.org) <thomasv@electrum.org>" [unknown]
gpg:                 aka "ThomasV <thomasv1@gmx.de>" [unknown]
gpg:                 aka "Thomas Voegtlin <thomasv1@gmx.de>" [unknown]
gpg: WARNING: This key is not certified with a trusted signature!
gpg:          There is no indication that the signature belongs to the owner.
Primary key fingerprint: 6694 D8DE 7BE8 EE56 31BE  D950 2BD5 824B 7F94 70E6

@bauerj
Copy link
Collaborator

bauerj commented Mar 10, 2018

Future Electrum binaries (hopefully starting with 3.1.1) will be code-signed with a (CA-) trusted certificate.

Hopefully this will improve the situation somehow.

@Alexsey
Copy link

Alexsey commented Mar 12, 2018

The results are better, but still quite untrustworthy:
electrum-3.1.1.exe - 5/65
electrum-3.1.1-setup.exe - 3/63
electrum-3.1.1-portable.exe - 4/66

@SomberNight SomberNight mentioned this issue Mar 24, 2018
Closed
@dabura667
Copy link
Contributor

The results are better, but still quite untrustworthy

............... if your measure of trustworthiness of a binary is based on how many anti-viruses it passes, you’re gonna have a bad time.

@Gliscor
Copy link

Gliscor commented Sep 1, 2018

Standalone version 3.2.2 it's being flagged too: https://www.virustotal.com/#/file/d56c94c2846605721a4ab9b578c422cfc9c88c962fd75524c73a75e1bf3a58a9/

@bauerj
Copy link
Collaborator

bauerj commented Sep 1, 2018

Thanks. I wonder why these products alert their users for something that they clearly recognize as "not-a-virus:NetTool.Win32.TorJok.amg".

@dabura667
Copy link
Contributor

I just verified that Thomas signed the exe with the hash d56c94c2846605721a4ab9b578c422cfc9c88c962fd75524c73a75e1bf3a58a9

False positive, or Thomas put a virus in it. But since Thomas is putting his neck on the line by being a public figure with his real name, I doubt it has a virus in it.

Remember, I could be lying to you. Verify yourself.

kthxbye

$ wget https://download.electrum.org/3.2.2/electrum-3.2.2.exe
--2018-09-02 14:47:56--  https://download.electrum.org/3.2.2/electrum-3.2.2.exe
Resolving download.electrum.org (download.electrum.org)... 78.46.103.75
Connecting to download.electrum.org (download.electrum.org)|78.46.103.75|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: 22278584 (21M) [application/x-msdos-program]
Saving to: 'electrum-3.2.2.exe'

electrum-3.2.2.exe  100%[====================================>]  21.25M  4.04MB/s    in 6.6s    

2018-09-02 14:48:04 (3.20 MB/s) - 'electrum-3.2.2.exe' saved [22278584/22278584]

################################

$ wget https://download.electrum.org/3.2.2/electrum-3.2.2.exe.asc
--2018-09-02 14:50:28--  https://download.electrum.org/3.2.2/electrum-3.2.2.exe.asc
Resolving download.electrum.org (download.electrum.org)... 78.46.103.75
Connecting to download.electrum.org (download.electrum.org)|78.46.103.75|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: 801 [text/plain]
Saving to: 'electrum-3.2.2.exe.asc'

electrum-3.2.2.exe.asc  100%[====================================>]  801  --.-KB/s    in 0s      

2018-09-02 14:50:29 (16.5 MB/s) - 'electrum-3.2.2.exe.asc' saved [801/801]

################################

$ sha256sum electrum-3.2.2.exe
d56c94c2846605721a4ab9b578c422cfc9c88c962fd75524c73a75e1bf3a58a9  electrum-3.2.2.exe

################################

$ gpg --verify electrum-3.2.2.exe.asc electrum-3.2.2.exe
gpg: Signature made 2018年07月02日 16時12分09秒 JST
gpg:                using RSA key 2BD5824B7F9470E6
gpg: Good signature from "Thomas Voegtlin (https://electrum.org) <thomasv@electrum.org>" [full]
gpg:                 aka "ThomasV <thomasv1@gmx.de>" [full]
gpg:                 aka "Thomas Voegtlin <thomasv1@gmx.de>" [full]

################################

$ gpg --fingerprint 2BD5824B7F9470E6
pub   rsa4096/2BD5824B7F9470E6 2011-06-15 [SC]
      Key fingerprint = 6694 D8DE 7BE8 EE56 31BE  D950 2BD5 824B 7F94 70E6
uid                 [  full  ] Thomas Voegtlin (https://electrum.org) <thomasv@electrum.org>
uid                 [  full  ] ThomasV <thomasv1@gmx.de>
uid                 [  full  ] Thomas Voegtlin <thomasv1@gmx.de>
sub   rsa4096/1A25C4602021CD84 2011-06-15 [E]

This was referenced Dec 28, 2018
Closed
Closed
@SomberNight SomberNight mentioned this issue Jan 22, 2019
Closed
@JeremyRand
Copy link
Contributor

I was thinking we could try to encrypt the binaries, to throw off antivirus heuristics.

@SomberNight This is not a good approach IMO, as it will make it more difficult to reverse-engineer the binaries. Reverse-engineering the binaries would be useful for things like auditing whether a compiler bug (or backdoor) has produced a security issue in the binary (which is something that reproducible builds won't necessarily protect you from).

@SomberNight
Copy link
Member

Lots of users keep asking about Electrum exes being flagged by different anti-viruses, so I would like to clarify the "official" stance of the project.

from #4986 (comment):

"Anti-virus" software uses shitty heuristics to detect malware. PyInstaller is a convenient tool to package python apps. We use PyInstaller. Malware authors use PyInstaller. Everything that uses PyInstaller is detected as malware.

Anti-virus software have (and always had) false positives, and some of them tag Electrum as malware. This is out of our control. This does not mean that Electrum is or contains malware.

The Windows binaries are signed using the native Windows signing scheme by an entity named Electrum Technologies GmbH. They are also signed using GPG by @ecdsa (ThomasV). The GPG key fingerprint is 6694D8DE7BE8EE5631BED9502BD5824B7F9470E6.

If you trust the developers of the project, you can verify the GPG signature, and ignore any anti-virus warnings.

If you don't trust the developers with not backdooring the binaries, you can (1) build binaries yourself; or (2) you can run from source. Some of the binaries are built reproducibly, so you can also check that those match.

If you have the technical knowledge, the time, and willingness, you are more than welcome to look into our build process, the tools being used, our dependencies, or just the source code in general, and suggest changes.

@rt121212121 rt121212121 mentioned this issue Jan 31, 2019
Closed
@SomberNight SomberNight mentioned this issue Feb 9, 2019
Closed
@ecdsa
Copy link
Member

ecdsa commented Feb 16, 2019

@SomberNight I will add a note to the website, summarizing your comment

@ecdsa
Copy link
Member

ecdsa commented Feb 16, 2019

done. closing this

@ecdsa ecdsa closed this as completed Feb 16, 2019
@pooler pooler mentioned this issue Mar 15, 2019
Open
This was referenced Jun 9, 2019
Closed
Closed
@SomberNight
Copy link
Member

We now build a custom PyInstaller bootloader; see 1d0f679
This seems to reduce the number of false positive AV detections.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
antivirus-false-positive ❎ OS-windows 🪟
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests